CVE-2023-25643

Two Vulnerabilities in Some ZTE Mobile Internet Products

State: Published
Severity: 8.4 High
Published: Dec 14, 2023
Updated: Aug 28, 2024
Reserved: Feb 9, 2023

Description

There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	zte

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
MC801AZTE	MC801A_Elisa3_B19 through B19Affected
MC801A1ZTE	MC801A1_Elisa1_B04 through B04Affected

References

https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032504

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.